The `new array.constructor()` pattern is occasionally used in JS
(presumably, to get the array subtype if one is available). GopherJS in
particular does this. This fixes DDC's generic `JSArray<T>` to support
this pattern, for all values of T. This also makes JSArray work like
all other "native" types in DDC, where the "constructor" property
is the JS constructor for that native type.

Rationale:
Queries the constant of a shift operation to determine if it
is in range when range analysis has not run. This seems in general
a good idea, since some optimizations occur *after* range analysis,
and we were missing those cases. In this particular case, it also
avoids an assert fail on a shift by one without env() that was
introduced by a pass that has no subsequent range analysis. In
this case, it is unclear whether not having an env() was an
accident, or on purpose since the shift factor is known to
be well-behaved. Please have a careful look!

Analyzer unit tests exercising the behavior of UI-as-code had to be
replicated so that we could test the behavior both with and without
constant-update-2018.

Note that as of the writing of this CL, constant-update-2018 has been
enabled by default, so there is no immediate functional change. The
change will take effect if we decide to back out constant-update-2018.

Do not append `!` to type names in tests that exercise NullabilitySuffix.none.

Appending `!` is confusing because it suggests a non-nullable version
of the type. But the absence of a `?` or `*` suffix doesn't mean the
type is non-nullable. For type parameters, the type might or might
permit null depending on how it is instantiated.

In 79974bb02605d0cc16c8a8bda8de23920a890649 I accidentally renamed one
of the withNullability methods, causing it to become disconnected from
the method it was overriding. This CL undoes the bogus rename.